Summary
Ein Angreifer kann mehrere Schwachstellen in DrayTek Vigor Routern ausnutzen, um beliebigen Code auszuführen, Cross-Site-Scripting-Angriffe durchzuführen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen.
Product
DrayTek Vigor ist eine Serie von Netzwerkgeräten, die von der Firma DrayTek hergestellt wird
Vulnerabilities 21
-
Critical 9.8
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_…
-
High 8.8
DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests.
-
High 8.0
A stack-based Buffer Overflow vulnerability in DrayTek Vigor310 devices through 4.3.2.6 allows a remote attacker to exe…
-
High 8.0
The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overfl…
-
High 8.0
Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on…
-
High 8.0
DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because G…
-
High 8.0
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to change settings or cause a denial of service via .c…
-
High 8.0
Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because …
-
High 7.5
An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the htt…
-
High 7.5
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chglog.cgi. …
-
High 7.5
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPeerId parameter at vpn.cgi. This vulne…
-
High 7.5
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPPPSrvNm parameter at fwuser.cgi. This …
-
High 7.5
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the fid parameter at v2x00.cgi. This vulnera…
-
High 7.5
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sCloudPass parameter at v2x00.cgi. This …
-
High 7.5
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at wizfw.cgi. Thi…
-
High 7.5
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iprofileidx parameter at dialin.cgi. Thi…
-
Medium 6.8
DrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an attacker…
-
Medium 6.1
DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.
-
Medium 5.4
Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor3…
-
Medium 4.7
DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to stored Cross Site Scripting (XSS) by authenticated users du…
-
Medium 4.7
DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing val…
Revision history
-
#1
Initiale Fassung
References
-
DrayTek Security Advisory vom 2024-10-06
https://www.draytek.com/about/security-advisory/cross-site-scripting,-denial-of-service-and-remote-code-execution-vulnerabilities
-
DrayTek Security Advisory vom 2024-10-06
https://www.draytek.com/about/security-advisory/buffer-overflow-vulnerability